CA backup and recovery solution contains flaws

Two vulnerabilities were reported today in a CA backup and recovery solution that, if exploited, could allow an attacker to execute remote code and gain unauthorized administrative privileges.

The flaws, discovered by the X-Force research and development team at IBM Internet Security Systems (ISS), are found in CA Brightstor ARCserve, a storage solution largely deployed by small- and medium-size businesses.

According to IBM ISS advisories released today, the two bugs are similar and can be exploited through a stack-based buffer overflow. This could lead to the exposure of confidential information, loss in productivity and a compromised network.

Pete Allor, director of intelligence at IBM ISS, said organizations should take the vulnerabilities seriously because they affect products that manage mission-critical data.

"CA Brightstor ARCserve is widely deployed in corporate environments," he said. "Since it is normally used for the protection and recovery of mission-critical applications, and since these two vulnerabilities are not difficult to exploit, ISS recommends that companies using CA Brightstor ARCserve patch immediately."

A CA spokesman told SCMagazine.com today that the company has patched the flaws and that it was not aware of any customers being affected.

Click here to email reporter Dan Kaplan.

Sign up to our newsletters